An uncontrolled resource consumption vulnerability exists in the JSON plugin of Apache Struts. When configured to populate actions from a JSON request body, the plugin reads the entire body into memory without properly bounding the size, allowing a single request to exhaust heap memory and cause denial of service. The plugin's configurable JSON input length limit does not effectively restrict this behavior. This affects Apache Struts versions from 2.1.8 through 2.3.37, 2.5.0 through 2.5.33, 6.0.0 through 6.10.0, and 7.0.0 through 7.2.1. Upgrading to versions 6.11.0 or 7.3.0 resolves the issue.